APPLIED [OEM-5.6] Re: [Focal/linux-oem-5.6][CVE-2020-15852][PATCH v2] x86/ioperm: Fix io bitmap invalidation on Xen PV
Timo Aaltonen
tjaalton at ubuntu.com
Mon Aug 24 08:16:26 UTC 2020
On 12.8.2020 17.35, William Breathitt Gray wrote:
> From: Andy Lutomirski <luto at kernel.org>
>
> tss_invalidate_io_bitmap() wasn't wired up properly through the pvop
> machinery, so the TSS and Xen's io bitmap would get out of sync
> whenever disabling a valid io bitmap.
>
> Add a new pvop for tss_invalidate_io_bitmap() to fix it.
>
> This is XSA-329.
>
> Fixes: 22fe5b0439dd ("x86/ioperm: Move TSS bitmap update to exit to user work")
> Signed-off-by: Andy Lutomirski <luto at kernel.org>
> Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
> Reviewed-by: Juergen Gross <jgross at suse.com>
> Reviewed-by: Thomas Gleixner <tglx at linutronix.de>
> Cc: stable at vger.kernel.org
> Link: https://lkml.kernel.org/r/d53075590e1f91c19f8af705059d3ff99424c020.1595030016.git.luto@kernel.org
>
> CVE-2020-15852
>
> (cherry picked from commit cadfad870154e14f745ec845708bc17d166065f2)
> Signed-off-by: William Breathitt Gray <william.gray at canonical.com>
> ---
> arch/x86/include/asm/io_bitmap.h | 16 ++++++++++++++++
> arch/x86/include/asm/paravirt.h | 5 +++++
> arch/x86/include/asm/paravirt_types.h | 1 +
> arch/x86/kernel/paravirt.c | 3 ++-
> arch/x86/kernel/process.c | 18 ++----------------
> arch/x86/xen/enlighten_pv.c | 12 ++++++++++++
> 6 files changed, 38 insertions(+), 17 deletions(-)
>
> diff --git a/arch/x86/include/asm/io_bitmap.h b/arch/x86/include/asm/io_bitmap.h
> index ac1a99ffbd8d..7f080f5c7def 100644
> --- a/arch/x86/include/asm/io_bitmap.h
> +++ b/arch/x86/include/asm/io_bitmap.h
> @@ -19,12 +19,28 @@ struct task_struct;
> void io_bitmap_share(struct task_struct *tsk);
> void io_bitmap_exit(struct task_struct *tsk);
>
> +static inline void native_tss_invalidate_io_bitmap(void)
> +{
> + /*
> + * Invalidate the I/O bitmap by moving io_bitmap_base outside the
> + * TSS limit so any subsequent I/O access from user space will
> + * trigger a #GP.
> + *
> + * This is correct even when VMEXIT rewrites the TSS limit
> + * to 0x67 as the only requirement is that the base points
> + * outside the limit.
> + */
> + this_cpu_write(cpu_tss_rw.x86_tss.io_bitmap_base,
> + IO_BITMAP_OFFSET_INVALID);
> +}
> +
> void native_tss_update_io_bitmap(void);
>
> #ifdef CONFIG_PARAVIRT_XXL
> #include <asm/paravirt.h>
> #else
> #define tss_update_io_bitmap native_tss_update_io_bitmap
> +#define tss_invalidate_io_bitmap native_tss_invalidate_io_bitmap
> #endif
>
> #else
> diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
> index 694d8daf4983..0296dd66c167 100644
> --- a/arch/x86/include/asm/paravirt.h
> +++ b/arch/x86/include/asm/paravirt.h
> @@ -296,6 +296,11 @@ static inline void write_idt_entry(gate_desc *dt, int entry, const gate_desc *g)
> }
>
> #ifdef CONFIG_X86_IOPL_IOPERM
> +static inline void tss_invalidate_io_bitmap(void)
> +{
> + PVOP_VCALL0(cpu.invalidate_io_bitmap);
> +}
> +
> static inline void tss_update_io_bitmap(void)
> {
> PVOP_VCALL0(cpu.update_io_bitmap);
> diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
> index 732f62e04ddb..8dfcb2508e6d 100644
> --- a/arch/x86/include/asm/paravirt_types.h
> +++ b/arch/x86/include/asm/paravirt_types.h
> @@ -141,6 +141,7 @@ struct pv_cpu_ops {
> void (*load_sp0)(unsigned long sp0);
>
> #ifdef CONFIG_X86_IOPL_IOPERM
> + void (*invalidate_io_bitmap)(void);
> void (*update_io_bitmap)(void);
> #endif
>
> diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
> index c131ba4e70ef..97b4ce839b4c 100644
> --- a/arch/x86/kernel/paravirt.c
> +++ b/arch/x86/kernel/paravirt.c
> @@ -343,7 +343,8 @@ struct paravirt_patch_template pv_ops = {
> .cpu.swapgs = native_swapgs,
>
> #ifdef CONFIG_X86_IOPL_IOPERM
> - .cpu.update_io_bitmap = native_tss_update_io_bitmap,
> + .cpu.invalidate_io_bitmap = native_tss_invalidate_io_bitmap,
> + .cpu.update_io_bitmap = native_tss_update_io_bitmap,
> #endif
>
> .cpu.start_context_switch = paravirt_nop,
> diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
> index 3d88300ec306..070383626d7f 100644
> --- a/arch/x86/kernel/process.c
> +++ b/arch/x86/kernel/process.c
> @@ -323,20 +323,6 @@ void arch_setup_new_exec(void)
> }
>
> #ifdef CONFIG_X86_IOPL_IOPERM
> -static inline void tss_invalidate_io_bitmap(struct tss_struct *tss)
> -{
> - /*
> - * Invalidate the I/O bitmap by moving io_bitmap_base outside the
> - * TSS limit so any subsequent I/O access from user space will
> - * trigger a #GP.
> - *
> - * This is correct even when VMEXIT rewrites the TSS limit
> - * to 0x67 as the only requirement is that the base points
> - * outside the limit.
> - */
> - tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID;
> -}
> -
> static inline void switch_to_bitmap(unsigned long tifp)
> {
> /*
> @@ -347,7 +333,7 @@ static inline void switch_to_bitmap(unsigned long tifp)
> * user mode.
> */
> if (tifp & _TIF_IO_BITMAP)
> - tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw));
> + tss_invalidate_io_bitmap();
> }
>
> static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm)
> @@ -381,7 +367,7 @@ void native_tss_update_io_bitmap(void)
> u16 *base = &tss->x86_tss.io_bitmap_base;
>
> if (!test_thread_flag(TIF_IO_BITMAP)) {
> - tss_invalidate_io_bitmap(tss);
> + native_tss_invalidate_io_bitmap();
> return;
> }
>
> diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
> index 507f4fb88fa7..9621d31104b6 100644
> --- a/arch/x86/xen/enlighten_pv.c
> +++ b/arch/x86/xen/enlighten_pv.c
> @@ -841,6 +841,17 @@ static void xen_load_sp0(unsigned long sp0)
> }
>
> #ifdef CONFIG_X86_IOPL_IOPERM
> +static void xen_invalidate_io_bitmap(void)
> +{
> + struct physdev_set_iobitmap iobitmap = {
> + .bitmap = 0,
> + .nr_ports = 0,
> + };
> +
> + native_tss_invalidate_io_bitmap();
> + HYPERVISOR_physdev_op(PHYSDEVOP_set_iobitmap, &iobitmap);
> +}
> +
> static void xen_update_io_bitmap(void)
> {
> struct physdev_set_iobitmap iobitmap;
> @@ -1070,6 +1081,7 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
> .load_sp0 = xen_load_sp0,
>
> #ifdef CONFIG_X86_IOPL_IOPERM
> + .invalidate_io_bitmap = xen_invalidate_io_bitmap,
> .update_io_bitmap = xen_update_io_bitmap,
> #endif
> .io_delay = xen_io_delay,
>
applied to oem-5.6, thanks!
--
t
More information about the kernel-team
mailing list